Privacy Policy

Last Updated: September 2, 2026

Welcome to INNSTRATA (“Innstrata,” “we,” “us,” or “our”). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit https://www.innstrata.com, use our services, or interact with hotel technology powered by Innstrata, including identity verification using a physical identification document, a mobile driver’s license (mDL), digital ID, or Verify with Wallet.

When Innstrata processes hotel guest information on behalf of a hotel or lodging property, the hotel generally determines why the information is collected and how it is used. In those circumstances, Innstrata acts as a service provider or data processor for the hotel and processes the information according to the hotel’s instructions, our agreement with the hotel, and applicable law. Guests should also review the privacy policy of the hotel or property with which they are checking in.

We are committed to handling personal information securely, transparently, and in accordance with applicable privacy and data protection laws.

1. Who We Are

INNSTRATA provides software and technology services for hotels and hospitality businesses. Our services may include guest management, identity verification, digital registration and check-in workflows, property-management-system integrations, guest communications, chargeback protection, marketing tools, pricing tools, and hotel website services.

For privacy-related questions, contact us at:
Email: [email protected]

2. What Data We Collect

The information we collect depends on how you interact with Innstrata and which services a hotel has enabled.

Website and Business Information

Contact and Account Information: Name, email address, phone number, company or hotel information, login or account information, and information submitted through contact or support forms.
Payment and Billing Information: Billing details and payment-related information processed through payment providers such as Stripe.
Usage and Device Information: IP address, browser type, device type, pages visited, referring pages, and interaction data.
Marketing Information: Information submitted through newsletter signups, SMS opt-ins, promotional campaigns, or similar forms.
Scheduling Information: Information submitted when scheduling a meeting, demonstration, installation, or support session.

Hotel Guest and Identity Verification Information

When a hotel uses Innstrata for guest registration, check-in, or identity verification, we may process information supplied by the guest, the hotel, a physical identification document, a barcode, a mobile driver’s license, another supported digital identity credential, or an identity wallet.

Depending on the hotel’s workflow and the information necessary for the transaction, this information may include name, date of birth, age or an age-threshold result, address, issuing authority or jurisdiction, document type, document number, document issue date, document expiration date, driving privileges, ID photograph, and other identity attributes that are necessary for the hotel’s check-in, verification, fraud-prevention, safety, or legal requirements.

We do not request every available identity attribute in every transaction. Innstrata and the hotel are expected to request only the data reasonably necessary for the specific verification or check-in purpose.

Verify with Wallet and Mobile Driver’s License Data

Where a hotel offers Verify with Wallet or another supported mobile driver’s license or digital ID workflow, the guest is shown the identity information being requested before the guest authorizes the presentation. The guest may choose whether to share the requested information.

If the guest authorizes the request, Innstrata may receive and process the authorized identity information on behalf of the hotel so that Innstrata can verify the credential, populate the hotel’s registration or check-in workflow, and transfer the permitted information to the hotel and, when directed by the hotel, to the hotel’s property management system or other designated hotel system.

Depending on the hotel and transaction, Verify with Wallet data may include one or more of the following: given name, family name, address, date of birth, age, age-over-threshold result, issuing authority, document number, document issue date, document expiration date, driving privileges, ID photo, and other identity elements permitted by the wallet provider and required for the applicable hotel workflow.

Innstrata does not use Verify with Wallet identity data for advertising, behavioral advertising, sale of personal information, unrelated marketing, or unrelated profiling.

3. How We Collect Data

Website contact, signup, support, and account forms.
Hotel check-in, registration, and identity-verification workflows powered by Innstrata.
Physical identification documents and supported barcode or document-reading devices.
Mobile driver’s licenses, supported digital identity credentials, and Verify with Wallet after the guest authorizes the requested data presentation.
Hotel property management systems or other hotel systems when the hotel directs us to exchange information with those systems.
Analytics tools used on our public website.
Scheduling tools such as Calendly.
Payment processors such as Stripe.
Cookies and similar technologies used on our public website.

4. How We Use Hotel Guest and Verify with Wallet Data

When Innstrata processes guest identity information for a hotel, we use it only as necessary to provide the hotel-requested service. Uses may include:

Verifying a guest’s identity or age.
Authenticating an identity credential and confirming that it is valid or issued by a trusted authority.
Reducing manual data entry during hotel registration or check-in.
Populating a hotel registration card, guest record, or check-in form.
Transferring hotel-authorized data to the hotel or to a property management system or other hotel system selected by the hotel.
Supporting fraud prevention, security, loss prevention, chargeback documentation, or other hotel safety functions where enabled by the hotel and permitted by law.
Maintaining records at the hotel’s direction where retention is required for operational, contractual, legal, or regulatory purposes.
Providing technical support, security monitoring, auditing, and troubleshooting for the service.

The hotel is responsible for determining whether the information requested from a guest is appropriate for its check-in process and for providing any hotel-specific notices or obtaining any hotel-specific permissions required by law.

5. Other Purposes for Processing Personal Information

To provide, maintain, secure, and improve our services.
To provide customer support and respond to inquiries.
To process payments and manage billing.
To communicate with customers by email, SMS, or other requested channels.
To schedule meetings, demonstrations, installations, or support sessions.
To analyze public website traffic and improve website performance and user experience.
To detect, investigate, and prevent fraud, abuse, security incidents, or unlawful activity.
To comply with legal obligations, valid legal process, and lawful government requests.

6. Legal Bases for Processing

Where a legal basis is required, the basis depends on the context and applicable law. We may rely on:

Consent: Where you affirmatively agree to a particular collection or use, such as certain cookies or marketing communications.
Contract: Where processing is necessary to provide services requested by a customer or to perform our contractual obligations.
Hotel Instructions: Where Innstrata acts as a service provider or processor and processes guest information on behalf of a hotel in accordance with the hotel’s documented instructions.
Legal Obligation: Where processing is necessary to comply with applicable laws, regulations, court orders, or lawful requests.
Legitimate Interests: Where permitted, for purposes such as service security, fraud prevention, support, and improving our services, provided those interests are not overridden by applicable privacy rights.

7. Cookies and Website Analytics

We may use cookies and similar technologies on our public website for functionality, analytics, security, and user experience. Where required, a cookie banner or preference control is provided.

Website analytics and advertising technologies are not used to receive the contents of a guest’s Verify with Wallet identity presentation. We do not intentionally send Verify with Wallet identity attributes to Google Analytics, Stripe, Calendly, advertising platforms, or marketing providers merely because those services are used elsewhere on our website or within our business operations.

8. How We Share Personal Information

We disclose personal information only as necessary for the purposes described in this Privacy Policy.

The Hotel or Property: When Innstrata processes guest information for a hotel, we transfer the authorized information to that hotel as part of the guest registration, verification, or check-in service.
Hotel-Designated Systems: At the hotel’s direction, we may transfer authorized information to the hotel’s property management system, guest management platform, or another hotel-designated system.
Service Providers and Subprocessors: We may use hosting, infrastructure, security, communications, support, and other service providers that process data only as needed to provide services to Innstrata and our hotel customers and subject to contractual confidentiality, privacy, and security obligations.
Website and Business Service Providers: We may use providers such as Google Analytics for public website analytics, Stripe for payment processing, and Calendly for scheduling. These providers are not intended recipients of Verify with Wallet identity payloads.
Legal and Safety Disclosures: We may disclose information when required by law or when reasonably necessary to protect rights, safety, security, prevent fraud, or respond to valid legal process.
Business Transactions: Information may be transferred as part of a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to applicable law and appropriate safeguards.

Third Parties Involved in Verify with Wallet

The specific third parties that collect or retain identity information depend on the hotel and its configured systems. The participating hotel is generally a recipient of the guest information and may retain it under the hotel’s own privacy policy. A hotel may also direct Innstrata to send information to its property management system or another hotel technology provider. Guests should review the privacy policy of the hotel and any other entity identified as receiving or retaining the information.

Apple provides the Wallet technology used to present supported digital identity credentials. Information about Apple’s handling of IDs in Wallet is available at Apple’s IDs in Wallet & Privacy page.

Innstrata does not sell Verify with Wallet identity data and does not disclose it to data brokers, advertising networks, or unrelated marketing partners.

9. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the requested services, to follow a hotel’s documented instructions, to meet contractual requirements, to maintain security and audit records, or to comply with applicable law.

Verify with Wallet and mDL Retention

For Verify with Wallet, mobile driver’s license, and other digital identity transactions, Innstrata retains identity data only as needed to complete verification, transfer the authorized information to the hotel or hotel-designated system, provide the hotel’s configured service, and satisfy applicable legal, security, or contractual requirements.

The hotel determines whether guest identity information is retained in Innstrata and/or hotel systems and the applicable retention period for the hotel’s records. If Innstrata is used only for verification and transmission and the hotel has not instructed Innstrata to retain the identity information, Innstrata will delete or de-identify the identity information after the processing purpose is complete, subject to limited retention in security logs, disaster-recovery backups, or records required by law.

Raw encrypted identity payloads, cryptographic verification material, and temporary processing artifacts are not retained longer than reasonably necessary to complete verification, troubleshoot a transaction, protect the service, or satisfy a legal obligation.

A hotel may retain guest information after Innstrata transfers it to the hotel. The hotel’s retention practices are governed by the hotel’s privacy policy, operational requirements, contracts, and applicable law.

10. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, loss, or disclosure. Depending on the service, safeguards may include:

Encryption in transit using HTTPS/TLS and other appropriate encrypted transport mechanisms.
Encryption at rest where appropriate.
Access controls, authentication, and least-privilege practices.
Network security controls, monitoring, logging, and firewalls.
Security review, vulnerability management, and incident-response procedures.
Contractual privacy and security obligations for service providers that process personal information on our behalf.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We nevertheless work to protect personal information using safeguards appropriate to the nature of the information and the services provided.

11. International Data Transfers

Innstrata and the service providers used to operate our services may process personal information in the United States and other jurisdictions where we or our service providers operate. Those jurisdictions may have privacy laws that differ from the laws where you reside.

Where required by applicable law, we use appropriate safeguards for international transfers, which may include contractual protections, data processing agreements, recognized transfer mechanisms, or other legally permitted safeguards.

12. Your Privacy Rights

Depending on where you live and applicable law, you may have rights regarding your personal information, including the right to request access, correction, deletion, restriction, portability, or information about certain disclosures or processing activities. You may also have the right to object to certain processing or withdraw consent where processing is based on consent.

If your request concerns information collected by a hotel using Innstrata, the hotel may be the entity responsible for responding to the request. We may assist the hotel in responding where required by our agreement or applicable law.

To submit a privacy request to Innstrata, contact [email protected]. We may need to verify your identity before completing certain requests.

13. Children’s Privacy

Innstrata’s hotel and hospitality services are not directed to children for independent use. A hotel may process information relating to minors where necessary for lodging, identity, age, safety, or legal requirements and where permitted by applicable law. Innstrata processes such information only as necessary to provide the hotel-requested service and according to the hotel’s instructions.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version will be made available on https://www.innstrata.com or on the applicable Innstrata privacy-policy page.

When we update this policy, we will revise the “Last Updated” date at the top of the page. If required by law, we will provide additional notice of material changes.

15. Contact Us

If you have questions or concerns about this Privacy Policy, Innstrata’s handling of personal information, or a Verify with Wallet or mobile driver’s license transaction processed by Innstrata, contact us at:

Email: [email protected]
Website: https://www.innstrata.com